A plurality of byte ranges including at least one encrypted byte range forms a variant sample for providing a digital watermark in content output by a player device. The plurality of byte ranges is ordered in secured memory, and stored in unsecured memory including one or more encrypted byte ranges for further processing of the ordered plurality of byte ranges. In another aspect, a plurality of byte ranges forms a sample for content output from a player device, and includes at least one double-encrypted byte range. The plurality of byte ranges is stored in secured memory, and the at least one double-encrypted byte range is partially decrypted to generate at least one decrypted singe-encrypted byte range. The plurality of byte ranges is stored in unsecured memory using the at least one decrypted single-encrypted byte range in place of the at least one double-encrypted byte range.